CISA, FBI urge hardening of refrigeration and cold-chain systems

CISA, the FBI and federal partners issued an advisory on 5 November 2026 urging operators to harden industrial refrigeration and cold-chain monitoring systems, after a run of attacks that manipulated cooling controls across Europe and the US. The advisory names no threat actor and no vendor; its ask is blunt — get these controllers off the open internet.

What the advisory says

The guidance, published as US Government Partners Urge Hardening Industrial Refrigeration and Cold-Chain Monitoring Systems, covers the automated refrigeration and cold-chain monitoring widely used in healthcare, transportation, food and chemicals — systems that handle remote temperature monitoring, continuous logging, defrost-cycle management and energy optimization. It warns that attackers can abuse unpatched or internet-accessible controllers to change settings and force units into continuous heating or defrost cycles, destroying inventory and creating equipment hazards.

The incidents behind it

The advisory lands amid a cluster of attacks Hacker Posts has tracked:

• Hundreds of European supermarkets had refrigeration remotely manipulated and temperatures raised, with potentially millions of euros in spoiled stock — see the second wave across European supermarkets and the Danfoss regulators at the center of the French cases.
• The same week, cooling controls were tampered with at three of France's national blood bank (EFS) sites — see our coverage of the EFS incident.
• In August, freezers and refrigeration at several US military commissaries flipped to defrost or heating modes; the Defense Department inspector general is among those investigating.

Authorities have not said whether the incidents are connected. Per The Record, officials are alert to possible hybrid threats amid tensions with Russia; the Kremlin denies involvement. No group has claimed responsibility.

Action checklist

1. Inventory every refrigeration and cold-chain controller and identify which are reachable from the internet.
2. Remove unnecessary remote access; for access you must keep, put it behind a VPN with strong, phishing-resistant authentication.
3. Patch controllers and monitoring gateways to current firmware.
4. Alert on anomalous setpoint changes and unexpected defrost or heating cycles, and keep an out-of-band temperature check so a tampered logger can't hide spoilage.

Context

This is the latest in a cluster of refrigeration-tampering incidents we've covered — the Danfoss regulators, a second wave across European supermarkets, and the EFS blood banks — and the first to draw a formal US-government advisory tying the European and US cases into one guidance set. The through-line isn't a single CVE; it's internet-exposed operational technology with weak authentication, the same exposure that drives most ICS incidents. The advisory's ask is modest and old: get the controllers off the public internet. That it needed saying again, to this many operators, is the story.